mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Fable 5.1
49a76dbe50
SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DNSSEC and CAA checked per registrable domain by a new dns_posture stage, stored in domain_posture and folded onto every subdomains row under the zone, so posture:<check> is a host filter whose count equals the rows it opens. - shared/definitions/domain_posture.py mirrored by config/domain-posture.ts - dnsx for TXT/MX/CAA; a stdlib DO-bit query for DNSSEC (dnsx has none); the MTA-STS policy fetched over HTTPS, so the stage is touches_target with passive_capable - DMARC inheritance through sp, SPF lookups counted through includes in one batch per depth, null MX as a positive fact, DKIM stated as probed - an unanswered zone has no verdict and marks the run partial; a capped lookup count is not a pass - grammar field, facet, group dimension, overview panel, target and dashboard cell, web asset sheet section, report section, compare signal posture_weakened, digest line, dashboard spoofable signal over the rows, MCP tool domain_posture - finalize re-folds so rows written after the stage carry the zone's checks Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KAP7PmMKSfNAFse3s2y2Xj